Computer networks and systems have become indispensable tools for modern business. Modem enterprises use such networks for communications and for storage. The information and data stored on the network of a business enterprise is often a highly valuable asset. Modem enterprises use numerous tools to keep outsiders, intruders, and unauthorized personnel from accessing valuable information stored on the network. These tools include firewalls, intrusion detection systems, and packet sniffer devices.
FIG. 1 illustrates a simple prior art configuration of a local area network (LAN) 100 connected to the Internet 102. Connected to the LAN 100 are various components, such as servers 104, clients 106, and switch 108. Numerous other networking components and computing devices are connectable to the LAN 100. The LAN 100 may be implemented using various wireline or wireless technologies, such as Ethernet and the 802.11 the IEEE family of wireless communication standards. LAN 100 could be connected to other LANs.
In this prior configuration, the LAN 100 is connected to the Internet 102 via a router 110. This router 110 may be used to implement a firewall. Firewalls are widely used to try to provide users of the LAN 100 with secure access to the Internet 102 as well as to provide separation of a public Web server (for example, one of the servers 104) from an internal network (for example, LAN 100). Data leaving the LAN 100 to the Internet 102 passes through the router 110. The router 110 simply forwards packets as is from the LAN 100 to the Internet 102.
However, once an intruder has gained access to sensitive content inside a LAN such as LAN 100, there presently is no network device that can prevent the electronic transmission of the content from the network to outside the network. Similarly, there is no network device that can analyze the data leaving the network to monitor for policy violations, and make it possible to track down information leaks. What is needed is a comprehensive system to capture, store, and analyze data communicated using the enterprise's network.